docs: one role authority — precedence, normalization, and the overlay invariant (R3-04)

scripts/install/Install-Services.ps1

@@ -6,7 +6,10 @@
 
 .DESCRIPTION
     v2 consolidates the legacy OtOpcUa + OtOpcUaAdmin services into a single role-gated
-    OtOpcUaHost binary. The -Roles parameter sets the OTOPCUA_ROLES service env so
+    OtOpcUaHost binary. The -Roles parameter sets the OTOPCUA_ROLES service env — the
+    documented FALLBACK role source (archreview R3-04's EffectiveRoles.Resolve prefers
+    Cluster:Roles when it is set, else OTOPCUA_ROLES; this script only ever writes the
+    latter, which is still every non-hand-patched production node's only role knob) — so
     Program.cs decides what to mount (admin / driver / both). The Wonderware historian
     sidecar is installed with -InstallWonderwareHistorian; it listens on a TCP port
     (default 32569, configurable via -HistorianTcpPort) protected by the shared secret.
@@ -28,7 +31,9 @@
     - "admin,driver"  — single-node dev or all-in-one production node
     - "admin"          — admin-only HA pair member (Blazor + control-plane singletons)
     - "driver"         — driver-only node (OPC UA endpoint + per-node actors)
-    Written to the service env as OTOPCUA_ROLES.
+    Written to the service env as OTOPCUA_ROLES — the fallback role source. If this node
+    also carries a Cluster:Roles registry value (e.g. a hand-applied field fix), that
+    wins outright; see docs/Configuration.md's EffectiveRoles note (archreview R3-04).
 
 .PARAMETER HttpPort
     HTTP port for the AdminUI + auth endpoints. Default 9000. Written as ASPNETCORE_URLS.